Provenance-based Intrusion Detection: Opportunities and Challenges
Abstract
Intrusion detection is an arms race; attackers evade intrusion detection systems by developing new attack vectors to sidestep known defense mechanisms. Provenance provides a detailed, structured history of the interactions of digital objects within a system. It is ideal for intrusion detection, because it offers a holistic, attack-vector-agnostic view of system execution. As such, provenance graph analysis fundamentally strengthens detection robustness. We discuss the opportunities and challenges associated with provenance-based intrusion detection and provide insights based on our experience building such systems.
- Publication:
-
arXiv e-prints
- Pub Date:
- June 2018
- DOI:
- 10.48550/arXiv.1806.00934
- arXiv:
- arXiv:1806.00934
- Bibcode:
- 2018arXiv180600934H
- Keywords:
-
- Computer Science - Cryptography and Security;
- Computer Science - Systems and Control
- E-Print:
- 4 pages, TaPP'18